search assistant shopping wizard usw

Finnegan

hier habe ich die infizierten files von escan

File C:\DOKUME~1\Daniel\LOKALE~1\Temp\9.tmp infected by "Trojan.Win32.HideProc.a" Virus
File C:\WINDOWS\ipqj32.exe infected by "Backdoor.Win32.Small.dc" Virus
File C:\WINDOWS\system32\netcp.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus
File C:\WINDOWS\winte32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus.
File C:\WINDOWS\system32\netcp.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus.
File C:\WINDOWS\crya32.exe infected by "Trojan-Downloader.Win32.Agent.ap"
File C:\WINDOWS\NDNuninstall4_85.exe infected by "not-a-virus:AdWare.NewDotNet"
File C:\WINDOWS\NDNuninstall6_22.exe infected by "not-a-virus:AdWare.NewDotNet"
File C:\WINDOWS\ozmwo.dll infected by "not-a-virus:AdWare.JS.OneMoreSearch.a" Viru
File C:\WINDOWS\zhmwc.dll infected by "not-a-virus:AdWare.JS.OneMoreSearch.a" Virus
File C:\WINDOWS\System32\addfd32.exe infected by "Backdoor.Win32.Small.dc" Virus
File C:\WINDOWS\System32\addka.exe infected by "Trojan-Downloader.Win32.Agent.ap
File C:\WINDOWS\System32\addxj.exe infected by "Backdoor.Win32.Small.dc"
File C:\WINDOWS\System32\criw.exe infected by "Backdoor.Win32.Small.dc"
File C:\WINDOWS\System32\luebc.dll infected by "not-a-virus:AdWare.JS.OneMoreSearch.a"
File C:\WINDOWS\System32\oaand.dll infected by "not-a-virus:AdWare.JS.OneMoreSearch.a
File C:\WINDOWS\System32\sermr.dll infected by "not-a-virus:AdWare.JS.OneMoreSearch.a"
File C:\WINDOWS\System32\vld1306.dll infected by "not-a-virus:AdWare.BHO.NoName.a"
File C:\WINDOWS\System32\vrpbq.dll infected by "not-a-virus:AdWare.JS.OneMoreSearch.a
File C:\WINDOWS\System32\znwhz.dll infected by "not-a-virus:AdWare.JS.OneMoreSearch.
File C:\DOKUME~1\Daniel\LOKALE~1\Temp\9.tmp infected by "Trojan.Win32.HideProc.a"
File C:\Files\Archive\Installer\DivXPro511Adware.exe infected by "not-a-virus:AdWare.Gator.3202
File C:\m.exe infected by "Trojan.Win32.Small.j
File C:\System Volume Information\_restore{3C31EBCC-85EF-4B91-A41F-8677FC36C500}\RP1\A0000056.exe infected by "not-a-virus:AdWare.WebHancer.214
File C:\System Volume Information\_restore{3C31EBCC-85EF-4B91-A41F-8677FC36C500}\RP1\A0000065.exe infected by "not-a-virus:AdWare.WebHancer.214
File C:\System Volume Information\_restore{3C31EBCC-85EF-4B91-A41F-8677FC36C500}\RP1\A0000140.dll infected by "Trojan-Downloader.Win32.Agent.bc
File C:\System Volume Information\_restore{3C31EBCC-85EF-4B91-A41F-8677FC36C500}\RP1\A0000141.exe infected by "Trojan-Downloader.Win32.Agent.ap
File C:\System Volume Information\_restore{3C31EBCC-85EF-4B91-A41F-8677FC36C500}\RP1\A0000142.exe infected by "Backdoor.Win32.Small.dc
File C:\WINDOWS\crya32.exe infected by "Trojan-Downloader.Win32.Agent.ap

ich hoffe ich hab alles erwischt.

und hier das neue hijack log.
Logfile of HijackThis v1.99.0
Scan saved at 02:20:56, on 25.01.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Programme\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\HPQ\One-Touch\OneTouch.EXE
C:\Programme\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\carpserv.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\TCMMOU~1\MouseDrv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Lexmark X125\LEX125SU.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\WEBDE\SmartSurfer2.3\SmartSurfer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Dokumente und Einstellungen\Daniel\Desktop\AboutBuster\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tiscali
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1E94F949-F3F0-5C64-038A-53C68D35F288} - C:\WINDOWS\system32\javamz.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programme\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Programme\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Programme\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [AtiPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TCMMouse ] C:\PROGRA~1\TCMMOU~1\MouseDrv.exe
O4 - HKLM\..\Run: [netcp.exe] C:\WINDOWS\system32\netcp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lexmark X125 Einstellungsdienstprogramm.lnk = C:\Programme\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .mov: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mpg: C:\Programme\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.de
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct1_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/potc_x.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1095174727891
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - http://arcade.icq.com/multiplayer/odyssey_web8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{08C4B2E1-2E44-4E25-A59F-FCA3660BCB51}: NameServer = 195.182.110.132 62.134.11.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{08C4B2E1-2E44-4E25-A59F-FCA3660BCB51}: NameServer = 195.182.110.132 62.134.11.4
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: HP Configuration Interface Service - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Programme\HPQ\Notebook Utilities\HPWirelessMgr.exe

Ist da jetzte alles weg?